Getting Data In

syslog-ng to HEC data persistence


How would we ensure data persistence/queuing when using Ryan Faircloth's (or a similar script) method to batch the syslog messages using a script rather than the default one message per POST of syslog-ng's http() output ?

Scenario is if there's an 1h network outage between syslog-ng and the HEC HWFs
0 Karma

New Member

Take a look at the native splunk-hec() driver in recent versions of syslog-ng PE.

Batching and load balancing are built in now.

0 Karma